DHS PRIVACY OFFICE

Status: Original and derived artifacts are available for this document.

Download: pdf

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

PRIVACY THRESHOLD ANALYSIS (PTA)
This form serves as the official determination by the DHS Privacy Office to
identify the privacy compliance requirements for all Departmental uses of
personally identifiable information (PII).
A Privacy Threshold Analysis (PTA) serves as the document used to identify
information technology (IT) systems, information collections/forms, technologies,
rulemakings, programs, information sharing arrangements, or pilot projects that involve
PII and other activities that otherwise impact the privacy of individuals as determined by
the Chief Privacy Officer, pursuant to Section 222 of the Homeland Security Act, and to
assess whether there is a need for additional Privacy Compliance Documentation. A PTA
includes a general description of the IT system, information collection, form, technology,
rulemaking, program, pilot project, information sharing arrangement, or other Department
activity and describes what PII is collected (and from whom) and how that information is
used and managed.
Please complete the attached Privacy Threshold Analysis and submit it to your
component Privacy Office. After review by your component Privacy Officer the PTA is sent
to the Department’s Senior Director for Privacy Compliance for action. If you do not have a
component Privacy Office, please send the PTA to the DHS Privacy Office:
Senior Director, Privacy Compliance
The Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
Tel: 202-343-1717
[email protected]

Upon receipt from your component Privacy Office, the DHS Privacy Office will review this
form and assess whether any privacy compliance documentation is required. If compliance
documentation is required – such as Privacy Impact Assessment (PIA), System of Records
Notice (SORN), Privacy Act Statement, or Computer Matching Agreement (CMA) – the DHS
Privacy Office or component Privacy Office will send you a copy of the relevant compliance
template to complete and return.
Privacy Threshold Analysis – IC/Form

Page 1 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis (PTA)

Specialized Template for
Information Collections (IC) and Forms
The Forms-PTA is a specialized template for Information Collections and Forms. This
specialized PTA must accompany all Information Collections submitted as part of the
Paperwork Reduction Act process (any instrument for collection (form, survey,
questionnaire, etc.) from ten or more members of the public). Components may use this PTA
to assess internal, component-specific forms as well.
Form Number:

Form Title:

Component:

FF-008-FY-21-100 (formerly 008-0-26), FF-008-FY-21-101
(formerly 008-0-27), FF-008-FY-21-102 (formerly 091-0-1), and
FF-008-FY-XX-XX
Integrated Preparedness Plans (IPPs), National Exercise
Program (NEP) Support Request Form, and After Action
Report/Improvement Plan (AAR/IP)
Federal Emergency
Office:
NED/NPD/Resilience
Management Agency
(FEMA)

IF COVERED BY THE PAPERWORK REDUCTION ACT:
Collection Title:
Homeland Security Exercise and Evaluation Program (HSEEP)
OMB Control
Number:
Collection status:
Name:
Office:
Phone:

Documentation
1660-0118
Revision

OMB Expiration
Date:
Date of last PTA (if
applicable):

January 31, 2024
May 10, 2023

PROJECT OR PROGRAM MANAGER
Sayoko Hamilton
National Exercise Division
Title:
Section Chief
202-212-7191
Email:
[email protected].
gov

Privacy Threshold Analysis – IC/Form

Page 2 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Name:
Office:

Phone:

COMPONENT INFORMATION COLLECTION/FORMS CONTACT
Krista Westinson
Information Management
Title:
PRA Clearance Officer
Division
202-394-6377
Email:
[email protected]
SPECIFIC IC/Forms PTA QUESTIONS

1. Purpose of the Information Collection or Form
a. Describe the purpose of the information collection or form. Please provide a
general description of the project and its purpose, including how it supports the DHS
mission, in a way a non-technical person could understand (you may use
information from the Supporting Statement).
If this is an updated PTA, please specifically describe what changes or upgrades are
triggering the update to this PTA.
FEMA submits this Forms PTA per the three-year expiration since the previously
adjudicated PTA (May 10, 2023). Since the previously adjudicated PTA, the change to this
collection includes the update to the form numbers as reflected below and the change to
the acronym from Training and Exercise Plan (TEP) to Integrated Preparedness Plan
(IPP) due to changes in doctrine. However, there have been no changes to the forms or
the information that is collected since the previously adjudicated PTA.
The Homeland Security Exercise and Evaluation Program (HSEEP) provides a set of
guiding principles for exercise programs, as well as a common approach to exercise
program management, design and development, conduct, evaluation, and improvement
planning. Exercises are a key component of national preparedness – they provide elected
and appointed officials and stakeholders from across the whole community with the
opportunity to shape planning, assess and validate capabilities, and address areas for
improvement.
Through HSEEP, state, local, tribal and territorial governments are provided grant
funding to develop, execute, and evaluate exercises that address the priorities
established by their emergency preparedness managers. As a condition of this funding,
grantees are required to complete an After-Action Report/Improvement Plan (AAR/IP)
as well as a Multi-Year Integrated Preparedness Plan (IPP).
FF-008-FY-21-100 (formerly 008-0-26)
Privacy Threshold Analysis – IC/Form

Page 3 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

The Multi-Year Integrated Preparedness Plan (IPP) is completed by preparedness
grantees, who are state, local, territorial, and tribal governments. The IPP identifies a
jurisdiction’s exercise program priorities and the scheduled training and exercise events
to meet those priorities. The form collects point of contact PII in order to provide
guidance to the jurisdictions on the IPP.

FF-008-FY-21-101 (formerly 008-0-27)
The National Exercise Program Nomination Form is completed by
jurisdictions/organizations seeking to submit their exercises for inclusion in the National
Exercise Program (NEP). NEP is the principal exercise mechanism for examining
preparedness and measuring readiness across the nation. The form collects point of
contact PII in order to notify jurisdictions that their exercises will be included in the NEP.
FF-008-FY-21-102 (formerly 091-0-1)
The Homeland Security Exercise and Evaluation Program (HSEEP) After Action Report
and Improvement Plan (AAR/IP) is completed by preparedness grantees, who are state,
local, territorial and tribal governments. The HSEEP AAR/IP form is a standard form for
reporting on the results of preparedness exercises and provides assessments of the
grantee’s capabilities so that strengths and areas for improvement are identified,
corrected, and shared as appropriate to improve national preparedness for all hazards.
The form collects point of contact PII in order to provide guidance to the jurisdictions on
the HSEEP AAR/IP.

FF-008-FY-XX-XX
The Exercise Experience Survey is completed by state, local, tribal, and territorial
exercise planners that have conducted an exercise. The Exercise Experience Survey form
collects participant feedback on their experiences with National Exercise Division (NED)
exercise support as well as planning exercises in accordance with FEMA’s Homeland
Security Exercise and Evaluation Program (HSEEP) guidance in order to improve
exercise implementation support.

b. List the DHS (or component) authorities to collect, store, and use this information.
If this information will be stored and used by a specific DHS component, list the
component-specific authorities.
The Homeland Security Act of 2002, as amended by Title I of the Implementing
Recommendations of the 9/11 Commission Act of 2007, 6 U.S.C. §§ 313.

Privacy Threshold Analysis – IC/Form

Page 4 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Post-Katrina Emergency Management Reform Act, United States Code (U.S.C.), Title 6,
Chapter 2, Subchapter II, Part A, Section 748(b)(1).
2. Describe the IC/Form
a. Does this form collect any
Personally Identifiable
Information” (PII 1)?

b. From which type(s) of
individuals does this form
collect information?
(Check all that apply.)

c. Who will complete and
submit this form? (Check
all that apply.)

☒ Yes
☐ No

☒ Members of the public
☒ U.S. citizens or lawful permanent
residents
☐ Non-U.S. Persons.
☐ DHS Employees
☐ DHS Contractors
☐ Other federal employees or contractors.

☐ The record subject of the form (e.g., the
individual applicant).
☐ Legal Representative (preparer, attorney,
etc.).
☐ Business entity.
If a business entity, is the only
information collected business contact
information?
☐ Yes
☐ No
☐ Law enforcement.
☐ DHS employee or contractor.
☒ Other individual/entity/organization that is
NOT the record subject. Please describe.
The form will be completed by the Exercise Point
of Contact for a jurisdiction submitting the form
to meet grant requirements.

1
Personally identifiable information means any information that permits the identity of an individual to be directly or indirectly inferred, including
any other information which is linked or linkable to that individual regardless of whether the individual is a U.S. citizen, lawful permanent resident,
visitor to the U.S., or employee or contractor to the Department.

Privacy Threshold Analysis – IC/Form

Page 5 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

d. How do individuals
complete the form? Check
all that apply.

☐ Paper.
☒ Electronic. (ex: fillable PDF)
☐ Online web form. (available and submitted via
the internet)
Provide link:

e. What information will DHS collect on the form? List all PII data elements on the
form. If the form will collect information from more than one type of individual,
please break down list of data elements collected by type of individual.
FF-008-FY-21-100 (formerly 008-0-26)
The IPP collects the following information from primary exercise points of contact:
• Name;
• Title;
• Agency;
• Work address;
• Work phone number; and
• Work e-mail address.

FF-008-FY-21-101 (formerly 008-0-27)
The NEP nomination form collects the following information from primary exercise
points of contact:
• Name;
• Work email address; and
• Work phone number
FF-008-FY-21-102 (formerly 091-0-1)
HSEEP AAR/IP collects the following information from primary exercise points of
contact:
• Name;
• Title;
• Agency;
• Work address;
• Work phone number; and
• Work e-mail address.
FF-008-FY-XX-XX

Privacy Threshold Analysis – IC/Form

Page 6 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Exercise Experience Survey form collects the following information from primary
exercise points of contact:
• Agency type;
• Community type(s) served.

f. Does this form collect Social Security number (SSN) or other element that is
stand-alone Sensitive Personally Identifiable Information (SPII)? Check all that
apply.
☐ Social Security number
☐ DHS Electronic Data Interchange
Personal Identifier (EDIPI)
☐ Alien Number (A-Number)
☐ Social Media Handle/ID
☐ Tax Identification Number
☐ Known Traveler Number
☐ Visa Number
☐ Trusted Traveler Number (Global
☐ Passport Number
Entry, Pre-Check, etc.)
☐ Bank Account, Credit Card, or other
☐ Driver’s License Number
financial account number
☐ Biometrics
☐ Other. Please list:

g. List the specific authority to collect SSN or these other SPII elements.
N/A

h. How will this information be used? What is the purpose of the collection?
Describe why this collection of SPII is the minimum amount of information
necessary to accomplish the purpose of the program.
N/A
i.

Are individuals
provided notice at the
time of collection by
DHS (Does the records
subject have notice of
the collection or is
form filled out by
third party)?

Privacy Threshold Analysis – IC/Form

☒ Yes. Please describe how notice is provided.
A Privacy Notice is provided on the forms.

☐ No.

Page 7 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

3. How will DHS store the IC/form responses?
a. How will DHS store
☐ Paper. Please describe.
the original,
Click here to enter text.
completed IC/forms?
☒ Electronic. Please describe the IT system that will
store the data from the form.
A secure IT infrastructure with safeguard
procedures of sensitive information in accordance
with NIST, FedRamp, HHS, and FISMA guidelines.
☐ Scanned forms (completed forms are scanned into
an electronic repository). Please describe the
electronic repository.
Click here to enter text.
b. If electronic, how
does DHS input the
responses into the IT
system?

2

c. How would a user
search the
information
submitted on the
forms, i.e., how is the
information
retrieved?

☐ Manually (data elements manually entered). Please
describe.
☒ Automatically. Please describe.
Web survey data will be exported directly from
Voxco Online, an integrated application that
allows us to design surveys, manage samples,
conduct interviews, oversee quotas, and deliver
timely results. The Voxco survey system is hosted
on premise within FEMA contractor environment
which has a fault tolerant setup for infrastructure
and services including redundant power and
internet to ensure survey uptime.
☐ By a unique identifier. 2 Please describe. If
information is retrieved by personal identifier, please
submit a Privacy Act Statement with this PTA.
Click here to enter text.
☒ By a non-personal identifier. Please describe.
FEMA contractor maintains a secure Survey
Control System (SCS) that documents the

Generally, a unique identifier is considered any type of “personally identifiable information,” meaning any information that permits the identity
of an individual to be directly or indirectly inferred, including any other information which is linked or linkable to that individual regardless of
whether the individual is a U.S. citizen, lawful permanent resident, visitor to the U.S., or employee or contractor to the Department.

Privacy Threshold Analysis – IC/Form

Page 8 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

correspondence and tracks the status of all sample
members. The heart of this system is a sample ID
that is given to each survey respondent and used
in place of name, email address, or other PII. This
process ensures that all sample members’
information is protected and that they are
accounted for and given the proper disposition
code in line with American Association for Public
Opinion Research (AAPOR) and Council of
American Survey Research Organizations
(CASRO)/Insights Association and OPA guidelines.
d. What is the records
FEMA contractor will keep the data within a
retention
password protected file for at least three years
schedule(s)? Include
following the conclusion of the research. At three
the records schedule
years, the FEMA contractor and FEMA staff will assess
number.
the need keep it for longer. At seven years, the FEMA
contractor and staff will permanently delete the data
unless there is an expectation that there will be a
future need for it. Data kept after seven years will be
archived and password protected during the time it is
in our possession.
e. How do you ensure
The Homeland Security Exercise and Evaluation
that records are
Program (HSEEP) staff adheres to the FEMA
disposed of or deleted
Disposition schedule, to ensure compliance with the
in accordance with
records retention schedule, which outlines timelines,
the retention
description of files for records destruction, and or
schedule?
disposal of relevant documents associated with each
of its forms.
f. Is any of this information shared outside of the original program/office? If yes,
describe where (other offices or DHS components or external entities) and why.
What are the authorities of the receiving party?
☐ Yes, information is shared with other DHS components or offices. Please describe.
Click here to enter text.
☐ Yes, information is shared external to DHS with other federal agencies, state/local
partners, international partners, or non-governmental entities. Please describe.
Click here to enter text.

Privacy Threshold Analysis – IC/Form

Page 9 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

☒ No. Information on this form is not shared outside of the collecting office.

Please include a copy of the referenced form and Privacy Act Statement (if
applicable) with this PTA upon submission.
PRIVACY THRESHOLD REVIEW
(TO BE COMPLETED BY COMPONENT PRIVACY OFFICE)
Component Privacy Office Reviewer:

Date submitted to component Privacy
Office:
Date submitted to DHS Privacy Office:
Have you approved a Privacy Act
Statement for this form? (Only
applicable if you have received a
waiver from the DHS Chief Privacy
Officer to approve component Privacy
Act Statements.)

Everson Randy Hull
February 29, 2024
March 4, 2024

☐ Yes. Please include it with this PTA
submission.
☒ No. Please describe why not.
A Privacy Act Statement is not required
since the information collected on the
forms are not going into a System of
Records. However, a Privacy Notice is
provided on the form.

Component Privacy Office Recommendation:
Please include recommendation below, including what existing privacy compliance
documentation is available or new privacy compliance documentation is needed.
FEMA Privacy recommends that this collection continue to be categorized as privacy
sensitive due to the collection of PII from members of the public. As such, this collection
requires PIA coverage. FEMA recommends the following PIA coverage:

Privacy Threshold Analysis – IC/Form

Page 10 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

•

DHS/FEMA/PIA-013 Grant Management Programs

SORN coverage is not required for this collection because retrieval is done by the
government entity’s name, not a unique identifier.

Privacy Threshold Analysis – IC/Form

Page 11 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

PRIVACY THRESHOLD ADJUDICATION
(TO BE COMPLETED BY THE DHS PRIVACY OFFICE)
DHS Privacy Office Reviewer:

Erika Lewis (Schuntel Reddock)

PCTS Workflow Number:
Date approved by DHS Privacy Office:
PTA Expiration Date

0016585
March 20, 2024
March 20, 2027

DESIGNATION

Privacy Sensitive IC or
Form:

Yes If “no” PTA adjudication is complete.

DHS IC/Forms Review:

Choose an item.

Determination:

☐ PTA sufficient at this time.
☐ Privacy compliance documentation determination in
progress.
☐ New information sharing arrangement is required.
☐ DHS Policy for Computer-Readable Extracts Containing SPII
applies.
☐ Privacy Act Statement required.
☒ Privacy Impact Assessment (PIA) required.
☐ System of Records Notice (SORN) required.
☐ Specialized training required.
☐ Other. Click here to enter text.

Date IC/Form Approved Click here to enter a date.
by PRIV:
IC/Form PCTS Number: Click here to enter text.
Privacy Act
Choose an item.
Statement:
Click here to enter text.
PTA:
Choose an item.
Click here to enter text.
PIA:
System covered by existing PIA
Privacy Threshold Analysis – IC/Form

Page 12 of 13

Version number: 04-2016

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

If covered by existing PIA, please list: DHS/FEMA/PIA-013 Grant
Management Programs; DHS/FEMA/PIA-016 Application and
Registration Records for Training and Exercise Programs (ARRTEP)
If a PIA update is required, please list: Click here to enter text.
SORN:
Choose an item.
If covered by existing SORN, please list: Click here to enter text.
If a SORN update is required, please list: Click here to enter text.
DHS Privacy Office Comments:
Please describe rationale for privacy compliance determination above.
FEMA submits a renewal PTA to discuss information collected as part of the Homeland
Security Exercise and Evaluation Program (HSEEP), for the purpose of awarding grants
used to participate in the program. Since the previously adjudicated PTA, the change to this
collection includes an update to the form numbers and the change to the acronym from
Training and Exercise Plan (TEP) to Integrated Preparedness Plan (IPP) due to changes in
doctrine. There have been no changes to the forms or the information that is collected
since the previously adjudicated PTA.
The form collects PII from points of contact in order to provide guidance to the
jurisdictions on the HSEEP AAR/IP, as well as the TEP, and to notify jurisdictions that their
exercises will be included in the NEP.

DHS PRIV concurs that these forms are privacy-sensitive collections of information
requiring PIA coverage as information is collected from members of the public. Coverage is
provided by DHS/FEMA/PIA-013 Grant Management Programs, which lists OMB 16600118 as a source of information collected. Coverage is also provided by DHS/FEMA/PIA016 ARRTEP, which assesses the collection of PII for the purposes of administering training
and exercise programs, and lists POC contact information as information collected.
DHS PRIV concurs that SORN coverage is not required as information is not retrieved by a
unique identifier.

Privacy Threshold Analysis – IC/Form

Page 13 of 13

Version number: 04-2016